Storage, Database, and Security Operations
Storage, Database, and Security Operations
This domain covers block and object storage, database services, and the security controls that protect data and keys.
Core rules
- Block volumes are AD-specific and offer performance tiers: Lower Cost, Balanced, Higher Performance, and Ultra High Performance. Auto-tune adjusts performance to workload; volume performance units (VPUs) set the tier. Volume backups are incremental, stored in Object Storage, and can be copied across regions.
- Object Storage buckets are private by default and regional. Tiers are Standard, Infrequent Access, and Archive. Lifecycle policies move objects between tiers or delete them. Archive objects require restoration before download.
- Database options: Autonomous Database (serverless or dedicated) automates patching, backups, and scaling; DB systems (VM or bare metal) give more control and support Data Guard standbys and backup policies.
- Security: Vault stores keys and secrets; key rotation creates a new key version. Cloud Guard detects risky configurations; Security Zones enforce controls such as denying public buckets. Bastion provides managed SSH access without public IPs.
Worked example
A rule says objects older than 30 days must be cheap to retain but readable within hours. Create a lifecycle policy: transition to Infrequent Access at 30 days, then Archive at 90 days. For objects already in Archive, issue a restore before download, because Archive is not instantly readable. Do not use Archive for data that must be read on demand without a restore.
Traps
- Assuming block volumes are regional; they are AD-specific.
- Thinking Archive objects are immediately downloadable.
- Believing a bucket is public by default; it is private.
- Confusing key rotation with re-encrypting existing data; old key versions remain for decryption.
- Forgetting that Autonomous Database automates patching, while DB systems require patching windows you manage.